cloudfoundry / cloudfoundry/uaa-cli

uaac curl works but uaa curl does not.

Open
#86 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

unscheduled
Dominant language
Go
Stars
22
Forks
14
Avg merge
1d 11h
Merged PRs (30d)
11

Description

Good day, I am trying to figure out the difference between the Ruby uaac and Go uaa when using curl to update OpsMan authentication settings.
Below env vars are used in both cases:

# Env Vars
ENV_NAME=sandbox
opsman_password=$(credhub get -n "/concourse/${ENV_NAME}/opsman_password" -q)
decryption_passphrase=$(credhub get -n "/concourse/${ENV_NAME}/opsman_decryption_passphrase" -q)
unlock_user_password=$(credhub get -n "/concourse/${ENV_NAME}/opsman_unlock_user_password" -q)
payload="{
  \"authentication\": {
    \"decryption_passphrase\": \"${decryption_passphrase}\",
    \"identity_provider\": \"internal\",
    \"admin_user_name\": \"admin\",
    \"admin_password\": \"${opsman_password}\",
    \"admin_password_confirmation\": \"${opsman_password}\"
  }
}"

This works (Ruby uaac):

uaac target https://pcf.${ENV_NAME}.westeurope.api.mtn.com/uaa
uaac token owner get opsman unlock_user -s '' -p "${unlock_user_password}"

uaac curl -X PUT -H "Content-type: application/json" https://pcf.${ENV_NAME}.westeurope.api.mtn.com/api/v0/settings/authentication -d "${payload}"

I get:

--snip--
200 OK
--snip--

and in the OpsMan access.log:

155.93.175.238 - opsman [20/Apr/2021:10:09:35 +0000] "POST /uaa/oauth/token HTTP/1.1" 200 2532 "-" "HTTPClient/1.0 (2.8.3, ruby 2.5.1 (2018-03-29))"
155.93.175.238 - - [20/Apr/2021:10:09:51 +0000] "PUT /api/v0/settings/authentication HTTP/1.1" 200 12 "-" "Ruby"

This does not work (Go uaac):

./uaa target https://pcf.${ENV_NAME}.westeurope.api.mtn.com/uaa
./uaa get-password-token opsman -s '' -u unlock_user -p "${unlock_user_password}"

./uaa curl -X PUT -H "Content-type: application/json" https://pcf.${ENV_NAME}.westeurope.api.mtn.com/api/v0/settings/authentication -d "${payload}"

I get:

--snip--
        <div class="alert alert-error">
            <p>Invalid login attempt, the request does not meet our security standards and may indicate that the action was not originated by you. Please try again.</p>
        </div>
--snip--

and in the OpsMan access.log:

155.93.175.238 - opsman [20/Apr/2021:09:55:09 +0000] "POST /uaa/oauth/token HTTP/1.1" 200 2516 "-" "Go-http-client/1.1"
155.93.175.238 - - [20/Apr/2021:09:57:41 +0000] "PUT /uaa/https:/pcf.sandbox.westeurope.api.mtn.com/api/v0/settings/authentication HTTP/1.1" 302 0 "-" "Go-http-client/1.1"
155.93.175.238 - - [20/Apr/2021:09:57:41 +0000] "GET /uaa/login?error=invalid_login_request HTTP/1.1" 200 49404 "https://pcf.sandbox.westeurope.api.mtn.com/uaa/https:/pcf.sandbox.westeurope.api.mtn.com/api/v0/settings/authentication" "Go-http-client/1.1"

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the shown Ruby and Go uaac/uaa curl commands and compare the access.log requests. Start at the uaa curl command entry point and trace how the target URL is combined with the requested URL. Done means the Go command sends the PUT to /api/v0/settings/authentication without the duplicated /uaa/https:/ prefix and receives the successful response.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.